Linux Process Creation: Ruby -e Reverse Shell Socket Usage
Detects inline Ruby (-e) using rsocket/TCPSocket and shell keywords, which may indicate reverse-shell style behavior.
FreeReviewedSigma · Medium · v2
- Product
- linux
- Category
- process_creation
- Author
- @d4ns4n_ (SigmaHQ), DRL 1.1
- Published
- 2023-04-07
- Updated
- 2026-07-31
What it detects
This rule flags Linux process creation events where Ruby is executed with the "-e" flag and the command line includes socket-related identifiers such as "rsocket" and "TCPSocket". These strings are commonly associated with Ruby scripts that attempt to open network connections, a prerequisite for reverse-shell style behavior. It relies on process creation telemetry that records the Image name and full CommandLine.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-process-creation-ruby-e-scripts-calling-tcpsocket-via-rsocket-b8bdac18
title: "Linux Process Creation: Ruby -e Reverse Shell Socket Usage"
id: 32c50815-79f7-46cb-a83a-df48351c3b9c
status: test
description: This rule flags Linux process creation events where Ruby is executed with the "-e" flag and the command line includes socket-related identifiers such as "rsocket" and "TCPSocket". These strings are commonly associated with Ruby scripts that attempt to open network connections, a prerequisite for reverse-shell style behavior. It relies on process creation telemetry that records the Image name and full CommandLine.
references:
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
Image|contains: ruby
CommandLine|contains|all:
- " -e"
- rsocket
- TCPSocket
CommandLine|contains:
- " ash"
- " bash"
- " bsh"
- " csh"
- " ksh"
- " pdksh"
- " sh"
- " tcsh"
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: b8bdac18-c06e-4016-ac30-221553e74f59
type: derived